MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3be1e0513df81445da2fccdcbb05b027da941ff46a5fdf819509d8956a58e932. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3be1e0513df81445da2fccdcbb05b027da941ff46a5fdf819509d8956a58e932
SHA3-384 hash: 060879a9554277f19da8ec426ffbfb45697f0e2df24a4bc45ef63cacb45e875c375d58df1765cc68eff6e84ba4db2b04
SHA1 hash: 603bb5ec687af125684514c31daf0dbf6f12938d
MD5 hash: 6410e99ca7ac7e32aa92fed576a5a791
humanhash: zulu-social-solar-east
File name:PO.4029530.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'033'133 bytes
First seen:2020-05-22 08:47:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:D7bKsQqnbGPDHTibZMIiVPD1GEwHPDH2N7JmKuIih4ZM:D7bZQqnqjTibZ5iVPxGBD47Jmjxh46
TLSH 402533B37497F3D80ECAC4EDED6011D783AE11B86A068DBCDE4E550DD28168BD8E215E
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.strongmailvault.com
Sending IP: 111.90.144.214
From: office@jinpao.us
Subject: Re: PO.4029530 URGENT
Attachment: PO.4029530.zip (contains "(PO.4029530.exe")

AgentTesla SMTP exfil server:
smtp.itanlprotec.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 09:35:59 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
26 of 48 (54.17%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3be1e0513df81445da2fccdcbb05b027da941ff46a5fdf819509d8956a58e932

(this sample)

AgentTesla

Executable exe ea12e8397d1e8afb620094bdb30d803b2f667b15fc8e415c94b8c6c3c6c403f4

  
Dropping
MD5 dc40b576daf11fc6aa4b3bef810f7531
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ea12e8397d1e8afb620094bdb30d803b2f667b15fc8e415c94b8c6c3c6c403f4

Comments